How to determine your disaster recovery objectives

How to determine RTO and RPO

You can define your disaster recovery objectives in four basic steps.

• Start with the business. From an operations perspective, the business has certain expectations about the availability of specific data, applications and systems. Start discussions with the executive team, line of business owners, application owners, etc., about what their availability needs are.
• Define downtime per data set. For each application, set of files, system or combination thereof, have the executive team share how the business will be impacted if each is unavailable. Let them decide what kind of downtime and data loss the business can accept. When you're done, you should have a comprehensive list of the entire environment's recovery needs.

• Translate this to disaster recovery objectives. In essence, these discussions should provide the context needed to establish RTOs and RPOs for every part of the business. For example, if the executive team says it can't be without on-premises email for more than an hour and can't lose more than 30 minutes of data, you know you have an RTO of 1 hour and an RPO of 30 minutes.
• Consider what's actually possible. Despite the fact that the executive team may have certain objectives, those may not be compatible with your current backup and recovery infrastructure. Take your objective requirements, compare them with what's possible and establish attainable objectives. You should also go back to the executive team to show them this gap and ask for a higher budget, citing the business needs not being met with the current infrastructure.

By following these four steps, you'll know exactly what the business requires, what your recovery goals look like and whether you'll be able to achieve them.